top of page

Privacy Policy

Please see below or alternatively download here

 

Privacy Policy

Version 4.6 · Issued 17 October 2026 · Next review October 2027

GES UK Consultancy Ltd (“GES”, “we”, “us”) is committed to protecting your personal information. This Privacy Policy explains what personal data we collect, why, how we use and share it, how long we keep it, and your rights. It is issued under Articles 13 and 14 of the UK General Data Protection Regulation (UK GDPR).

 
1. Who we are

GES UK Consultancy Ltd (company number 09442784), Unit 12, Oakfield Business Centre, Westbury, Wiltshire, BA13 4WF, is the controller of your personal data. GES supplies staff to event and festival sites across the south west of the UK.

Data Protection Lead: Alan Fiddes, Director – alan@gesltduk.com – 01373 825467.

 
2. Who this policy covers

GES staff and job applicants; staff supplied to GES by our Service Partners; client, Service Partner and supplier contacts; and anyone who contacts us by email, letter, telephone, SMS, our website or in person.

 
3. What we collect and where from

  • Identity and contact: Name, date of birth, address, phone, email, photograph, emergency contact.

  • Licensing and right to work: SIA licence number and status, right to work documents, National Insurance number.

  • Screening and criminal offence data: Employment history and references (BS 7858), DBS check outcome, declarations, outcome of police (PNC) checks.

  • Work records: Availability, deployments, hours worked, training, incident and accident reports, body-worn video or CCTV images.

  • Health (where needed): Fitness for work, first aid treatment, accident details, reasonable adjustments.

  • Payment (GES direct staff only): Bank details, tax code, pension information.

  • Business contacts and website: Name, role, company, correspondence; website and cookie data.

 

We collect data from you directly and also from: our Service Partners (staff lists and licence details); the SIA public register; the DBS; referees and former employers; event organisers; and the police or local authorities (results of checks).

 
4. Why we use your data and our lawful basis

  • SIA licence checks and right to work checks: Legal obligation.

  • Recruitment and BS 7858 screening: Contract; legitimate interests (safe, compliant workforce).

  • Rostering, contacting you about work, recording hours worked, payment and invoicing: Contract; legal obligation (HMRC).

  • Submitting staff lists to the police and local authorities for checks required by premises licences: Legitimate interests; recognised legitimate interests (crime prevention).

  • Event accreditation and passes: Contract; legitimate interests (meeting client requirements).

  • Health and safety, accident and RIDDOR reporting: Legal obligation; vital interests in an emergency.

  • Incident reports, CCTV and body-worn video: Legitimate interests; recognised legitimate interests (crime prevention, safeguarding, emergencies).

  • Dealing with enquiries, complaints and legal claims: Legitimate interests; legal obligation.

  • Business-to-business updates and marketing: Legitimate interests (PECR soft opt-in) or consent – you can opt out at any time.

 

Where we process health data we rely on our employment and health and safety obligations (Article 9(2)(b) UK GDPR and DPA 2018 Schedule 1). Where we process criminal offence data we rely on DPA 2018 Schedule 1 conditions, including preventing or detecting unlawful acts, and hold an Appropriate Policy Document.

Providing licence, right to work and screening information is a legal or contractual requirement; without it we cannot deploy you to an event. We do not make decisions about you using solely automated processing.

 
5. Who we share your data with

We share only what is necessary with: our Service Partners; event organisers and venue operators; the police and local authority licensing teams; the SIA and DBS; HMRC and pension providers; our insurers and professional advisers; and IT, email, cloud storage, online form (Jotform), staff deployment system hosting (Contabo), website hosting (Wix) and payroll providers acting as our processors under contract. We disclose data where required by law. We never sell your personal data.

We store data in the UK wherever possible. Our staff deployment system (TREVA) is hosted by Contabo in France (EU), which is covered by UK adequacy regulations. If a provider acting for us transfers data outside the UK, we make sure it is protected by UK adequacy regulations or an approved safeguard such as the ICO International Data Transfer Agreement.

 

AI assistant: GES uses Claude, an AI assistant provided by Anthropic, for drafting templates and policy text only, on an individual Claude Max plan under Anthropic’s consumer terms. We do not enter any personal data into Claude, so Anthropic does not receive your personal data from us and is not one of our processors.

Our website: www.gesltduk.com is hosted by Wix, acting as our processor. Cookies that are strictly necessary for the site to work and stay secure are always set. We set non-essential cookies (such as analytics) only with your consent, which you can give or withdraw at any time through the cookie banner. If you contact us through the website, we use your details only to deal with your enquiry. Any website data processed outside the UK is protected as described above.

 
6. How long we keep your data

We keep data only as long as needed, in line with our Data Retention and Deletion Policy, for example:

  • Police staff lists – 6 months after the event

  • Deployment records – 3 years

  • Incident reports – 6 years

  • CCTV/BWV – 31 days unless linked to an incident

 
7. How we keep your data secure

We use access controls, multi-factor authentication, encryption, secure paper storage and staff training. If a breach is likely to result in a high risk to you, we will tell you without undue delay.

 
8. Your rights

You have the right to: be informed; access your data (a subject access request); have inaccurate data corrected; have data erased in certain circumstances; restrict or object to processing; data portability; and object to direct marketing at any time. Where we rely on consent, you can withdraw it at any time.

To use any of these rights, contact our Data Protection Lead. We will respond within one month (extendable by two months for complex requests). We may ask for proof of identity; the time limit starts once we receive it. There is normally no charge.

 
9. Complaints

If you are unhappy with how we have handled your data, please contact us first: email enquiries@gesltduk.com, telephone 01373 825467 or write to our head office. Your complaint is passed to our Data Protection Lead. We will acknowledge it within 30 days and tell you the outcome without undue delay.

You can also complain to the Information Commission (ICO): www.ico.org.uk/make-a-complaint or 0303 123 1113.

 
10. Changes to this policy

We review this policy annually and whenever the law or the way we use personal data changes. The current version is published at www.gesltduk.com/privacy-policy, issued to all staff at induction and available on request. We will tell staff and Service Partners about significant changes.

 

Alan Fiddes, Director, GES UK Consultancy Ltd

GES UK Consultancy Ltd · Head office: Unit 12, Oakfield Business Centre, Westbury, Wiltshire, BA13 4WF · Tel: 01373 825467 · enquiries@gesltduk.com · Company No. 09442784 · VAT No. 233187614

​

 

bottom of page